Adding a user account into the protected users group causes the protected user to not be able to log into the CA client.
The following error message can be seen in the client log file:
2019-10-17 11:50:28.637 [5][INFO][ChangeAuditor.MainForm.TryConnectRepository(0)] Connecting using Info, DNS=myhost.domain.local Port=60443, SPN=NPRepository4(Default)/myhost.domain.local
2019-10-17 11:50:30.168 [5][INFO][ChangeAuditor.MainForm.OpenCoordinatorServiceClient(0)] The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:30:00'.
2019-10-17 11:50:30.168 [5][ERROR][ChangeAuditor.MainForm.TryConnectRepository(0)] System.ServiceModel.CommunicationException: The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:30:00'. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host